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Abstract. Two orthonormal bases B and B' of a d-dimensional complex 
inner-product space are called mutually unbiased if and only if |(6|6') | 2 = 
1/d holds for all b £ B and b' £ B' . The size of any set containing 
pairwise mutually unbiased bases of C d cannot exceed d + 1. If d is a 
power of a prime, then extremal sets containing d + 1 mutually unbiased 
bases are known to exist. We give a simplified proof of this fact based 
on the estimation of exponential sums. We discuss conjectures and open 
problems concerning the maximal number of mutually unbiased bases 
for arbitrary dimensions. 
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1 Motivation 

The notion of mutually unbiased bases emerged in the literature of quantum 
mechanics in 1960 in the works of Schwinger ^2]. Two orthonormal bases B and 
B' of the vector space C d are called mutually unbiased if and only if | ( b | b' ) | 2 = 
1/d holds for all b S B and all b' G B'. Schwinger realized that no information can 
be retrieved when a quantum system which is prepared in a basis state from B' 
is measured with respect to the basis B. A striking application is the protocol by 
Bennett and Brassard 5 which exploits this observation to distribute secret keys 
over a public channel in an information-thcoretically secure way (see also 0]). 

Any collection of pairwise mutually unbiased bases of C d has cardinality 
d + 1 or less, see 0^2^11 El 122- Extremal sets attaining this bound are of 
considerable interest. Ivanovic showed that the density matrix of an ensemble 
of d-dimensional quantum systems can be completely reconstructed from the 
statistics of measurements with respect to d + 1 mutually unbiased bases |14j . 
Furthermore, he showed that the density matrix cannot be reconstructed from 
the statistics of fewer measurements. 

Let N(d) denote the maximum cardinality of any set containing pairwise 
mutually unbiased bases of C d . It is known that N(d) = d + 1 holds when 
d is a prime power, see ^JE2H3]. We derive a simplified proof of this result, 
which takes advantage of Weil-type exponential sums. We present two different 



constructions — both based on Weil sums over finite fields — in the case of odd 
prime power dimensions. We exploit exponential sums over Galois rings in the 
case of even prime power dimensions. If the dimension d is not a prime power, 
then the exact value of N(d) is not known. We discuss lower bounds, conjectures, 
and open problems in the fourth section. 

2 Odd Prime Powers 

Let ¥ q be a finite field with q elements which has odd characteristic p. Denote 
the absolute trace from F g to the prime field ¥ p by tr( • ). Each nonzero element 
x G ¥ q defines a non- trivial additive character ¥ q — > C x by 



where oj p = exp(2ni / p) is a primitive p-th root of unity. All non-trivial additive 
characters are of this form. 

Lemma 1 (Weil sums). Let ¥ q be a finite field of odd characteristic and x 
a non-trivial additive character of ¥ q . Let p(X) G F 9 [A] be a polynomial of 
degree 2. Then 



We refer to |171 Theorem 5.37] or p. 313] for a proof. We will use this lemma 
in the following constructions of mutually unbiased bases. 

Convention. In the following, we will tacitly assume that the elements of ¥ q 
are listed in some fixed order, and this order will be used whenever an object 
indexed by elements of ¥ q appears. 

We begin with a historical curiosity. Schwinger introduced the concept of 
mutually unbiased bases in 1960. However, he did not construct extremal sets 
of mutually unbiased bases, except in low dimensions, and no further progress 
was made during the next twenty years. Alltop constructed in 1980 complex 
sequences with low correlation for spread spectrum radar and communication 
applications 1 . It turns out that the sequences given by Alltop provide p + 1 
mutually unbiased bases in dimension p, for all primes p > 5. Unfortunately, 
Alltop was not aware of his contribution to quantum physics, and his work was 
not noticed until recently. Our first construction generalizes the Alltop sequences 
to prime power dimensions. 

Theorem 1. Let ¥ q be a finite field of characteristic p > 5. Let B a denote the 
set of vectors 



t tr(xy) 
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The standard basis and the sets B a , with a € ¥ q , form an extremal set of q + 1 
mutually unbiased bases of the vector space <C q . 



Proof. Notice that B a is an orthonormal basis because 



(b K , a \bx, a ) = -J2 
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Indeed, the right hand side equals when k / A because the argument k + a 
ranges through all values of F g ; and equals 1 when n = A. 

Note that all components of the sequence &a, a have absolute value 
hence the basis B a and the standard basis are mutually unbiased, for any a G¥ q . 

By computing the inner product | (6 K . Q , b\^) | for a ^ (3, we see that the terms 
cubic in k cancel out and, moreover, that the exponent is given by the trace of 
a quadratic polynomial in k. By Lemmanthe inner product evaluates to q^ 1 / 2 , 
hence B a and Bp are mutually unbiased. □ 

Remark 1. A remarkable feature of the previous construction is that knowledge 
of one basis B a is sufficient because shifting the indices by adding a field element 
yields the other bases. The construction does not work in characteristic 2 and 
3 because in these cases the sets B a and Bp, with a / ft are not mutually 
unbiased. 

Ivanovic gave a fresh impetus to the field in 1981 with his seminal paper [14| . 
Among other things, he gave explicit constructions of p + 1 mutually unbiased 
bases of C p , for p a prime. His construction was later generalized in the influential 
paper by Wootters and Fields |22]> who gave the first proof of the following 
theorem. This proof was recently rephrased by Chaturvedi [5] , and an alternate 
proof was given by Bandyopadhyay et al. [Hj • We give a particularly short proof 
by taking advantage of Weil sums. 

Theorem 2. Let ¥ q be a finite field with odd characteristic p. Denote by B a = 
{v a ,b | b £ F q } the set of vectors given by 

The standard basis and the sets B a , with a €¥ q , form an extremal set of q + 1 
mutually unbiased bases of C q . 



Proof. By definition 

\(Va,b\ V c,d)\ 
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Suppose that a = c. The right hand side evaluates to 1 if b = d, and to if b ^= d. 
This proves that B a is an orthonormal basis. The coefficients of the vector v a ^b 
have absolute value q -1 / 2 , hence B a is mutually unbiased with the standard 
basis. On the other hand, if a ^ c, then the right hand side evaluates to g -1 / 2 by 
Lemma n which proves that the bases B a and B c are mutually unbiased. □ 



Example 1. In dimension 3, this construction yields the bases 

Bo = {«o,o,«0,i,«0,a} = { 3-V2(i, 1,1), 3-V2(i, ^l), 3-Va(l, w |, a*)}, 
B, = {v lfi ,v hl ,v h2 } = { 3-^(1,^,^), 3-^(1, 0,2,1), 3-1/3(1, i, w |)}, 
S 2 = Ko, «a,i, «2,a} = { 3-^(1, wf , u> 2 3 ), 3- 1 /2(i, W3j i), 3-1/2(1, i, o, 3 )}, 
which form together with the standard basis four mutually unbiased bases. 

3 Even Prime Powers 

We showed in the last section that extremal sets of q+ 1 mutually unbiased bases 
exist in dimension q if q is a power of an odd prime. In this section we treat the 
case when q is a power of two. We cannot use Weil sums because Lemma^does 
not apply in even characteristics. However, it turns out that exponential sums 
over a finite Galois ring can serve as a substitute. 

We recall some elementary facts about finite Galois rings, see |2U] for more 
details. Let Z4 denote the residue class ring of integers modulo 4. Denote by (2) 
the ideal generated by 2 in Z4J2;]. A monic polynomial h(x) £ Zi[x] is called 
basic primitive if and only if its image in Z^[x]/(2) = 'Li\x\ under the canonical 
map is a primitive polynomial in Z,2[x\. Let h(x) be a monic basic primitive 
polynomial of degree n. The ring GR(4, n) = ^[x]/ (h(x)) is called the Galois 
ring of degree n over Z4 . 

The construction ensures that GR(4, n) has 4™ elements. The element £ = 
x + (h(x)) is of order 2 n — 1. Any element r £ GR(4, n) can be uniquely written 
in the form r = a + 2b, where a,b £ T n = {0, 1, £, . . . , £ 2 ~ 2 }. This representation 
in terms of the Teichmiiller set T n is convenient, since it allows us to characterize 
the units of GR(4, n) as the elements a + 2b with a^O. 

The automorphism a: GR(4, n) -> GR(4, n) defined by a {a + 2b) = a 2 + 2b 2 
is called the Frobenius automorphism. This map leaves the elements of the prime 
ring Z4 fixed. All automorphisms of GR(4, n) are of the form a k for some integer 
k > 0. The trace map tr: GR(4, n) — > Z4 is defined by tr(x) = X)fc=o ak ( x )- 

Lemma 2. Keep the notation as above. The exponential sum -T: GR(4,n) — > C 
defined by r(r) — J2 x eT ex P(^f i tr(rx)) satisfies 

( ifre27; i , r^O, 
\r(r)\ = i 2" ifr = 0, 

[ \/2™ otherwise. 

The above lemma is proved in jSJ Lemma 3], see also |23| . This lemma will be 
crucial in the next construction of mutually unbiased bases. 

Theorem 3. Let GR(4, rt) be a finite Galois ring with Teichmiiller setT n . For 
a £ T n , denote by M a = {v a ,& | b £ T n } the set of vectors given by 

v a , b = 2-" /2 ^cxp (^tr(a + 2b)x^j ^ 



The standard basis and the sets M a , with a G T n , form an extremal set of2 n + 1 
mutually unbiased bases of C 2 . 

Proof. By definition, 



If both vectors belong to the same basis, i.e., when a — a', then Lemma shows 
that the right hand side evaluates to in case b ^ b', and to 1 in case 6 = 6'. 
This shows that M a is an orthonormal basis. 

If the vectors belong to different bases, i.e., when a ^ a', then Lemma |21 
shows that \(v a ^\v a ' ,b')\ = 2~™/ 2 , hence M a and M a > are mutually unbiased. 
The entries of the vectors u a .& have absolute value 2~™/ 2 , thus the standard 
basis and M a are mutually unbiased for all a € GR(4, n) . □ 

Example 2. We illustrate this construction by deriving five mutually unbiased 
bases in C 4 . In this case, the Galois ring GR(4, 2) = Zi[x]/(x 2 + x + 1) with 
16 elements is the basis of the construction. The Teichmiiller set is given by 
T2 = {0, 1, 3£ + 3, £}. Recall that an element of GR(4, 2) can be represented in 
the form a + 26 with a, b G T 2 . By definition, tr(a + 26) = a + 26 + a 2 + 26 2 . 
Computing the basis vectors yields 



M = {1(1, 1, 1, 1), 1(1,1,-1,-1), 1(1, -1,-1,1), 1(1, -1,1,-1)}, 
M x = {1(1,-1, -i,-i), |(1,-1, i, i), 1(1, 1, i,-i), 1(1, 1,-i, i)}. 
M 3S+3 = {l(l,-i,-i,-l), |(1,-*, 1), i, 5(1, 1)}, 

M c = {i(l,-z,-i,-l), 1(1, -i, i, 1), 1(1, i, z,-l), 1(1, i,-*, 1)}. 



These four bases and the standard basis form an extremal set of five mutually 



4 Non Prime Powers 

In the previous two sections, we established that the number N(d) of mutually 
unbiased bases in dimension d attains the maximal possible value, N(d) = d + 1, 
when d is a prime power. In contrast, the exact value of N(d) is not known for 
any dimension d which is divisible by at least two distinct primes, not even in 
small dimensions such as d = 6. 

The problem to determine N(d) is similar to the combinatorial problem to 
determine the number M(d) of mutually orthogonal Latin squares of size d x d. 
The number M(d) is exactly known for prime powers but not in general when 
d is divisible by at least two distinct primes, see for more details. Lower 

bounds on the number of mutually orthogonal Latin squares can be obtained 
with the help of a lemma by MacNeish. Our next result formulates a similar 
statement for the number N(d) of mutually unbiased bases. 





unbiased bases of C 4 . 



Lemma 3. Let d = p" 1 ■ • -p" r be a factorization of d into distinct primes pi. 
Then 

N(d) > min {N(p a S),N(p a 2 >), N(p?)}. 

Proof. We denote the minimum by m = min^ N(p°^ i ). Choose m mutually unbi- 
ased bases b[ 1 \ . . . , Bm of C pa ' , for all i in the range 1 < i < r. Then 

{Bf®..jB[ r> :k = l,...,m} 
is a set of m mutually unbiased bases of C d . □ 

An easily memorable form of the above lemma is N(nm) > min{iV(n), N(m)} 
for all m, n > 2. A simple consequence is that N(d) > 3 for all dimensions d > 2, 
that is, in each dimension there are at least three mutually unbiased bases. 

Many researchers in the quantum physics community seem to be under the 
impression that N(d) = d + 1 for all integers d > 2. However, there is some 
numerical evidence that considerably fewer mutually unbiased bases might be 
possible if the dimension is not a prime power. In fact, a conjecture by Zauner 
on the existence of affine quantum designs implies that N(6) — 3 rather than 
N{6) = 7, see (23- 

Conjecture 1 (Zauner). The number of mutually unbiased bases in dimension 6 
is given by iV(6) = 3. 

Apparently, Zauner did considerable numerical computations to bolster his con- 
jecture. Our computational experiments indicate that N(d) is in general smaller 
than d + 1 when d is not a prime power. 

Problem 1. Does N(d) = d + 1 hold for any dimension d > 2 that is not a prime 
power? 

Another interesting problem concerns lower bounds on N(d). Recall that for 
mutually orthogonal Latin squares, M{d) — > oo for d — * oo, as shown by Chowla, 
Erdos, and Strauss JUj. It is natural to ask whether a similar property holds for 
the number of mutually unbiased bases: 

Problem 2. Does N(d) — > oo for d — * oo hold? 

More constructions of mutually unbiased bases are needed to prove such a result. 
A result similar to Wilson's theorem on the number of mutually orthogonal Latin 
squares [23 would be particularly interesting. 

5 Conclusions 

Mutually unbiased bases are basic primitives in quantum information theory. 
They have applications in quantum cryptography and the design of optimal 
measurements. It is known that in dimension d at most d+l mutually unbiased 
bases can exist. In this paper, we gave a simplified proof of the fact that d+l 
mutually unbiased bases exist in C d when d is a prime power. 



Specifically, we were able to generalize the construction by Alltop to powers 
of a prime p > 5. Elementary estimates of Weil sums allowed us to derive a 
particularly short proof of a theorem by Wootters and Fields. For dimensions d = 
2™, we took advantage of known properties of exponential sums over GR(4, n) 
to obtain extremal sets of mutually unbiased bases. 

An open problem is to determine the maximal number of mutually unbiased 
bases when the dimension is not a prime power. We derived an elementary lower 
bound for abritrary dimensions and discussed some conjectures and open prob- 
lems. Finally, we recommend the mean king's problem 19,12,2 as an enjoyable 
application of mutually unbiased bases. 
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